From 0372157a4875bb8e76da9aecbe84a64307ffafe7 Mon Sep 17 00:00:00 2001 From: Corey Farrell Date: Sat, 1 Jul 2017 20:24:27 -0400 Subject: AST-2017-006: Fix app_minivm application MinivmNotify command injection An admin can configure app_minivm with an externnotify program to be run when a voicemail is received. The app_minivm application MinivmNotify uses ast_safe_system() for this purpose which is vulnerable to command injection since the Caller-ID name and number values given to externnotify can come from an external untrusted source. * Add ast_safe_execvp() function. This gives modules the ability to run external commands with greater safety compared to ast_safe_system(). Specifically when some parameters are filled by untrusted sources the new function does not allow malicious input to break argument encoding. This may be of particular concern where CALLERID(name) or CALLERID(num) may be used as a parameter to a script run by ast_safe_system() which could potentially allow arbitrary command execution. * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp() instead of ast_safe_system() to avoid command injection. * Document code injection potential from untrusted data sources for other shell commands that are under user control. ASTERISK-27103 Change-Id: I7552472247a84cde24e1358aaf64af160107aef1 --- funcs/func_shell.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'funcs') diff --git a/funcs/func_shell.c b/funcs/func_shell.c index 0398cd839..fe1debe88 100644 --- a/funcs/func_shell.c +++ b/funcs/func_shell.c @@ -82,6 +82,11 @@ static int shell_helper(struct ast_channel *chan, const char *cmd, char *data, The command that the shell should execute. + Do not use untrusted strings such as CALLERID(num) + or CALLERID(name) as part of the command parameters. You + risk a command injection attack executing arbitrary commands if the untrusted + strings aren't filtered to remove dangerous characters. See function + FILTER(). -- cgit v1.2.3